Replace the Rust provider with a declarative one, and add PKCE sign-in

[Lookoff-AIMLAPI]

Syncs the fork to current upstream and reworks the AI/ML API integration.

Why the existing provider had to go rather than stay alongside

crates/goose/src/providers/aimlapi.rs (from PR #1) registered the provider name aimlapi. The new declarative definition registers the same name, so the two could not coexist — one of them had to win.

Two things decided which:

• The old one no longer builds. It is written on super::openai_compatible::OpenAiCompatibleProvider, and upstream has since deleted that module. The fork last synced on 2026-08-27; the breakage arrived with upstream changes after that, so it would have surfaced at the next sync regardless of this work.
• Declarative is the path the maintainer named. He said a PR with just the declarative enhancement would be accepted; a hand-written Rust provider is a much larger ask for the same result.

Its four model ids had also gone stale (google/gemini-3-7-flash, deepseek/deepseek-v4-pro-0813).

What was worth keeping came across: the X-AIMLAPI-Source and X-AIMLAPI-Partner-ID attribution headers now ride on the definition's headers block. Without them a request serves fine and is silently untagged, which is how partner attribution quietly stops working.

What lands

Piece	Notes
definitions/aimlapi.json	8 models with context limits read from the live catalog, not guessed; attribution headers; sorts first in the registry purely alphabetically
config/signup_aimlapi/	authorization-code + PKCE, built on the shape of the existing signup_openrouter
configure.rs	an "AI/ML API Login" item, placed after the two existing sign-ins rather than above them
examples/aimlapi_auth.rs	runs the flow without the TUI, mirroring their tetrate_auth example

Three deliberate departures from the OpenRouter flow it copies: the state is verified (OpenRouter's does not), the loopback port is 53682 rather than the commonly-occupied 3000, and an exchange failure is worded exactly as the server words it — the server does not distinguish an unknown code from a bad verifier from a real expiry, so neither does the client.

Verified, and not

Verified against a live environment, through this code rather than curl: authorization request registered, browser consent, redirect caught on the loopback listener, state matched, code exchanged, key issued. Then a real completion through the declarative provider with vendor-prefixed ids — anthropic/claude-sonnet-5 and openai/gpt-5-nano both round-tripped, so the prefix survives goose's wire path.

Not verified: the configure.rs edit does not typecheck here. goose-cli cannot build on this machine at all — bindgen needs libclang, which is absent, and it fails before reaching any of this code. goose and goose-providers both check clean. The CLI edit is a menu item plus a handler modelled directly on the OpenRouter one next to it, but it is unchecked, and CI should be the one to confirm it.

Before the upstream PR

• tests, mirroring signup_openrouter/tests.rs
• a demo video, which the maintainer asked for specifically if we do PKCE
• decide whether to split: declarative first (he will take it quickly), PKCE second